CVE-2022-50350 in Linux
Summary
by MITRE • 09/16/2025
In the Linux kernel, the following vulnerability has been resolved:
scsi: target: iscsi: Fix a race condition between login_work and the login thread
In case a malicious initiator sends some random data immediately after a login PDU; the iscsi_target_sk_data_ready() callback will schedule the login_work and, at the same time, the negotiation may end without clearing the LOGIN_FLAGS_INITIAL_PDU flag (because no additional PDU exchanges are required to complete the login).
The login has been completed but the login_work function will find the LOGIN_FLAGS_INITIAL_PDU flag set and will never stop from rescheduling itself; at this point, if the initiator drops the connection, the iscsit_conn structure will be freed, login_work will dereference a released socket structure and the kernel crashes.
BUG: kernel NULL pointer dereference, address: 0000000000000230 PF: supervisor write access in kernel mode PF: error_code(0x0002) - not-present page Workqueue: events iscsi_target_do_login_rx [iscsi_target_mod]
RIP: 0010:_raw_read_lock_bh+0x15/0x30 Call trace: iscsi_target_do_login_rx+0x75/0x3f0 [iscsi_target_mod]
process_one_work+0x1e8/0x3c0
Fix this bug by forcing login_work to stop after the login has been completed and the socket callbacks have been restored.
Add a comment to clearify the return values of iscsi_target_do_login()
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 02/23/2026
The vulnerability described in CVE-2022-50350 represents a critical race condition within the Linux kernel's iSCSI target implementation that can lead to kernel crashes and potential denial of service conditions. This flaw exists in the scsi target subsystem specifically within the iscsi module where the interaction between login work processing and connection handling creates a dangerous timing window. The issue manifests when a malicious iSCSI initiator sends unexpected data immediately following a login PDU, creating a scenario where the kernel's internal state becomes inconsistent and leads to memory corruption.
The technical root cause of this vulnerability lies in the improper handling of the LOGIN_FLAGS_INITIAL_PDU flag during the iSCSI login process. When the iscsi_target_sk_data_ready() callback is invoked, it schedules login_work which then attempts to process login-related data. However, if the negotiation completes before the flag is properly cleared, the login_work function enters an infinite loop of rescheduling itself because it continuously finds the LOGIN_FLAGS_INITIAL_PDU flag set. This creates a situation where the work function never terminates properly, even though the actual login process has completed successfully.
The operational impact of this vulnerability is severe as it can result in kernel NULL pointer dereferences and system crashes when the malicious initiator drops the connection. The crash occurs because the login_work function attempts to dereference a socket structure that has already been freed, leading to a supervisor write access violation with error code 0x0002 indicating a not-present page fault. The kernel stack trace shows the execution path leading to _raw_read_lock_bh function where the crash occurs, demonstrating that the workqueue events iscsi_target_do_login_rx [iscsi_target_mod] is the source of the problematic execution flow.
This vulnerability aligns with CWE-362, which describes race conditions in concurrent programming scenarios, and maps to ATT&CK technique T1499.004 for endpoint denial of service through kernel exploitation. The flaw demonstrates poor state management and synchronization mechanisms within the kernel's iSCSI target implementation. The fix implemented addresses this by forcing the login_work function to terminate properly after login completion and ensuring socket callbacks are restored appropriately. This mitigation prevents the infinite rescheduling loop while maintaining proper connection state handling and resource cleanup. The addition of comments to clarify return values of iscsi_target_do_login() improves code maintainability and reduces the likelihood of similar issues in future modifications to the codebase, following best practices for secure kernel development and proper state machine implementation.